一句话：对真实 Java 项目的依赖冲突进行实证研究并提出自动检测工具 Decca，评估严重性并过滤良性冲突。
Java 项目依赖第三方库时，classpath 上可能出现同一库或类的多个版本；JVM 只加载一个版本，若该版本缺少项目所需方法等特性，就会引发运行时异常，即依赖冲突（DC）问题。现有 Maven 等工具检测到的重复类/库告警可能是良性的，常被开发者忽略。作者对大型开源项目中的真实 DC 问题开展实证研究，总结其表现与修复模式，并据此设计 Decca：自动评估 DC 严重性并过滤良性告警。在 30 个项目上，Decca 检测高严重性 DC 问题的精确率为 0.923、召回率为 0.766，还发现新问题；提交 20 份报告，11 份被确认，6 份按建议补丁修复。
Intensive dependencies of a Java project on third-party libraries can easily lead to the presence of multiple library or class versions on its classpath. When this happens, JVM will load one version and shadows the others. Dependency conflict (DC) issues occur when the loaded version fails to cover a required feature (e.g., method) referenced by the project, thus causing runtime exceptions. However, the warnings of duplicate classes or libraries detected by existing build tools such as Maven can be benign since not all instances of duplication will induce runtime exceptions, and hence are often ignored by developers. In this paper, we conducted an empirical study on real-world DC issues collected from large open source projects. We studied the manifestation and fixing patterns of DC issues. Based on our findings, we designed Decca, an automated detection tool that assesses DC issues' severity and filters out the benign ones. Our evaluation results on 30 projects show that Decca achieves a precision of 0.923 and recall of 0.766 in detecting high-severity DC issues. Decca also detected new DC issues in these projects. Subsequently, 20 DC bug reports were filed, and 11 of them were confirmed by developers. Issues in 6 reports were fixed with our suggested patches.
DOI 原文 ·
@inproceedings{paperbot4669,
title = {Do the dependency conflicts in my project matter?},
author = {Ying Wang and Ming Wen and Zhenwei Liu and Rongxin Wu and Rui Wang and Bo Yang and Hai Yu and Zhiliang Zhu and Shing-Chi Cheung},
booktitle = {FSE},
year = {2018},
doi = {10.1145/3236024.3236056}
}